Documentation
¶
Index ¶
Constants ¶
const ( // LogCollectorNamespace and the fluent-bit/EKS network-identity symbols below are // aliased from the render package, where they live to avoid a render -> logcollector // import cycle (Guardian/Manager reference them when building NetworkPolicies). LogCollectorNamespace = render.LogCollectorNamespace FluentBitFilterConfigMapName = "fluent-bit-filters" FluentBitFilterFlowName = "flow" FluentBitFilterDNSName = "dns" S3FluentBitSecretName = "log-collector-s3-credentials" S3KeyIdName = "key-id" S3KeySecretName = "key-secret" // FluentBitTLSSecretName is the TLS secret used on all connections served by fluent-bit. FluentBitTLSSecretName = "calico-fluent-bit-tls" FluentBitMetricsService = "calico-fluent-bit-metrics" FluentBitMetricsServiceWindows = "calico-fluent-bit-metrics-windows" FluentBitInputService = render.FluentBitInputService FluentBitMetricsPortName = "fluent-bit-metrics-port" FluentBitMetricsPort = 2020 FluentBitInputPortName = "fluent-bit-input-port" FluentBitInputPort = 9880 FluentBitPolicyName = networkpolicy.CalicoComponentPolicyPrefix + "allow-calico-fluent-bit" EksLogForwarderSecret = "tigera-eks-log-forwarder-secret" EksLogForwarderAwsId = "aws-id" EksLogForwarderAwsKey = "aws-key" SplunkFluentBitTokenSecretName = "logcollector-splunk-credentials" SplunkFluentBitSecretTokenKey = "token" SplunkFluentBitSecretCertificateKey = render.SplunkFluentBitSecretCertificateKey SysLogPublicCADir = "/etc/pki/tls/certs/" SysLogPublicCertKey = "ca-bundle.crt" SysLogPublicCAPath = SysLogPublicCADir + SysLogPublicCertKey SyslogCAConfigMapName = "syslog-ca" SplunkCAConfigMapName = "splunk-ca" // Constants for Linseed token volume mounting in managed clusters. LinseedTokenVolumeName = render.LinseedTokenVolumeName LinseedTokenKey = render.LinseedTokenKey LinseedTokenSubPath = render.LinseedTokenSubPath LinseedTokenSecret = render.LinseedTokenSecret LinseedVolumeMountPath = render.LinseedVolumeMountPath LinseedTokenPath = render.LinseedTokenPath FluentBitConfConfigMapName = "calico-fluent-bit-conf" EKSLogForwarderConfConfigMapName = "eks-log-forwarder-conf" FluentBitNodeName = render.FluentBitNodeName EKSLogForwarderName = render.EKSLogForwarderName EKSLogForwarderTLSSecretName = "tigera-eks-log-forwarder-tls" )
Variables ¶
This section is empty.
Functions ¶
func FluentBitOSSpecific ¶
func FluentBitOSSpecific(cfg *FluentBitConfiguration, osType rmeta.OSType) render.Component
FluentBitOSSpecific renders the fluent-bit resources unique to one OS (DaemonSet, per-OS ConfigMap, metrics Service, RBAC/ServiceAccount, and on Linux the EKS forwarder and non-cluster-host input service). It takes the same FluentBitConfiguration the shared component does; the OS is passed separately so both OS instances render from one configuration, and the component applies the OS-specific logic internally.
func FluentBitShared ¶
func FluentBitShared(cfg *FluentBitConfiguration) render.Component
FluentBitShared renders the resources shared by the Linux and Windows fluent-bit installations: the NetworkPolicy, store credential copies, the managed-cluster Linseed plumbing, the GKE ResourceQuota and the legacy fluentd cleanup. Rendering them exactly once, from a single configuration, keeps the two OS components from contending over the same object with divergent definitions.
Types ¶
type EksCloudwatchLogConfig ¶
type FluentBitConfiguration ¶
type FluentBitConfiguration struct {
LogCollector *operatorv1.LogCollector
S3Credential *S3Credential
SplkCredential *SplunkCredential
Filters *FluentBitFilters
EKSConfig *EksCloudwatchLogConfig
PullSecrets []*corev1.Secret
Installation *operatorv1.InstallationSpec
ClusterDomain string
FluentBitKeyPair certificatemanagement.KeyPairInterface
TrustedBundle certificatemanagement.TrustedBundle
ManagedCluster bool
// Set if running as a multi-tenant management cluster. Configures the management cluster's
// own fluent-bit daemonset.
Tenant *operatorv1.Tenant
ExternalElastic bool
// Cloud indicates fluent-bit is being rendered for a Calico Cloud install. When true, cloud's
// reduced log feature set is applied (see cloudSuppressesFromLinseed); false leaves
// enterprise behavior unchanged.
Cloud bool
// Whether to use User provided certificate or not.
UseSyslogCertificate bool
// EKSLogForwarderKeyPair contains the certificate presented by EKS LogForwarder when communicating with Linseed
EKSLogForwarderKeyPair certificatemanagement.KeyPairInterface
NonClusterHost *operatorv1.NonClusterHost
// LicenseExpired indicates the license has expired and fluent-bit DaemonSet should be removed.
LicenseExpired bool
}
FluentBitConfiguration contains all the config information needed to render the component.
type FluentBitFilters ¶
func (*FluentBitFilters) InvalidKeys ¶
func (f *FluentBitFilters) InvalidKeys() []string
InvalidKeys returns the names of the fluent-bit-filters ConfigMap keys whose content is non-empty but does not parse as a fluent-bit YAML filter list — for example a leftover fluentd <filter> block after an upgrade. addUserFilters skips these during render so the pipeline still starts; callers use this to surface the misconfiguration to the user without failing the whole LogCollector.
type S3Credential ¶
type SplunkCredential ¶
type SplunkCredential struct {
Token []byte
}
Source Files